Sectigo: Incorrect JOI

Sectigo reported that it issued an EV TLS certificate with an incorrect Jurisdiction of Incorporation (JOI) on September 23, 2022. Sectigo said a validation agent noticed the issue shortly after issuance and reported it to its WebPKI Incident Response team. Sectigo contacted the subscriber to initiate a replacement and revocation process; a replacement certificate was issued and the mississued certificate was revoked on September 23, 2022. Sectigo explained that an automated JOI assignment process based on Registration QGIS matching failed due to a corner case: the validation agent accidentally selected an adjacent Registration QGIS source, and the Second Approval team did not spot the mismatch. Sectigo stated it had pre-issuance checks in place that would usually prevent similar mississuance, but that in this case the actual registration number met formatting criteria for the accidentally selected source, so the programmatic matching did not detect a problem. Sectigo completed remediation by deploying additional automated checks, with changes deployed on December 17, 2022, and requested the bug be closed; Mozilla indicated it would close the bug around December 21, 2022. The bug is marked RESOLVED with resolution FIXED.

1. 2022-09-23 Sectigo issued an EV TLS certificate with an incorrect JOI; the mississued certificate was later revoked and a replacement certificate was issued the same day.
2. 2022-12-17 Sectigo deployed additional automated checks to remediate the incident.

1. 2022-10-05 Sectigo — Sectigo described how the incorrect JOI EV TLS certificate was issued, how it was detected, and the remediation steps, including planned additional automated checks.
2. 2022-10-12 Sectigo — Sectigo said it was monitoring the bug for any comments while aligning remaining details.
3. 2022-10-19 Sectigo — Sectigo set an initial target deployment date of November 27 and requested a next update for November 30.
4. 2022-11-29 Sectigo — Sectigo reported coding for the additional automated check was complete and in QA, with rollout planned around mid-December.
5. 2022-12-06 Sectigo — Sectigo stated the code passed QA and targeted a December 17 deployment pending approval.
6. 2022-12-19 Sectigo — Sectigo reported the changes were deployed on December 17 and requested the bug be closed.
7. 2022-12-19 Mozilla representative — Mozilla said it would close the bug on or about Wed. 21-Dec-2022.